Potential stack buffer write overflow in Connext applications while parsing malicious license file

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• rti connext professional4.4 and later · before 5.3.1.45
• rti connext professional6.0.0 and later · before 6.0.1.40
• rti connext professional6.1.0 and later · before 6.1.2.21
• rti connext professional7.0.0 and later · before 7.3.0.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (RTI). Independent of NVD's CPE analysis and usually ahead of it.

• RTI Connext Professional

  • 7.0.0 and later · before 7.3.0.2affected
  • 6.1.0 and later · before 6.1.2.21affected
  • 6.0.0 and later · before 6.0.1.40affected
  • 4.4 and later · before 5.3.1.45affected

Other highest-scoring records for the same primary product.

• CVE-2026-7866Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
  40Plan
• CVE-2021-38435RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size
  39Monitor
• CVE-2026-18461Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.
  36Monitor
• CVE-2026-3894Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
  36Monitor
• CVE-2026-2467Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.
  36Monitor
• CVE-2024-52057Potential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.